Skip to content
AccessLens
FAQ

07Reference

Frequently asked questions

Permissions, licensing, roles, tenants and data handling: the questions administrators ask before connecting a tenant.

  • Does AccessLens store my Conditional Access policies?

    No. All policy data is processed entirely in your browser and stored in local storage. We never transmit, log, or persist your policies on any server.

  • Can AccessLens modify or delete my policies?

    No. AccessLens only requests read-only permissions (Policy.Read.All). We cannot create, modify, or delete any Conditional Access policies or other tenant resources.

  • What Entra ID licence do I need?

    Conditional Access policies require at least Microsoft Entra ID P1. AccessLens can read policies from any P1 or P2 tenant. The Entra ID Free tier does not include Conditional Access.

  • Do I need Global Admin to use AccessLens?

    No. The Security Reader or Global Reader built-in role is sufficient. We recommend Security Reader as the least-privilege option. Global Admin is never required.

  • Why does admin consent need to be granted?

    Microsoft requires admin consent for apps that read Conditional Access policies. This is a one-time action that can be performed by any Cloud Application Administrator or Application Administrator. Global Admin is not needed.

  • Can I use a custom Entra role instead of Security Reader?

    Unfortunately, no. Microsoft Entra custom roles do not currently support the Conditional Access read permission for delegated Graph API access. You must use a built-in role like Security Reader or Global Reader.

  • Is my data encrypted?

    All communication with Microsoft Graph API and our services uses TLS 1.2+. Policy data stored in your browser’s local storage is subject to your browser’s security model. We recommend clearing local storage on shared devices.

  • Can multiple team members use AccessLens on the same tenant?

    Yes. Each user signs in individually with their own account. With a team plan, you can invite team members and share reports. Each user needs the appropriate Entra role assigned.

  • How do I revoke AccessLens access?

    An admin can delete the AccessLens enterprise application from the Entra admin center (Identity → Applications → Enterprise applications → AccessLens). Individual users can revoke their consent at myaccount.microsoft.com.

  • Does AccessLens work with Azure AD B2C or external tenants?

    AccessLens is designed for Microsoft Entra ID (formerly Azure AD) workforce tenants. B2C and external identity tenants have different Conditional Access capabilities and are not currently supported.

  • How many tenants can I connect?

    Free and Starter cover 1 tenant. Professional includes 5 and can be expanded up to 100 by adding tenant capacity from the Tenants page, priced per tenant with volume discounts. Beyond 100 tenants, contact sales@accesslens.co.uk for enterprise pricing.

  • I am an MSP. Can I manage all my client tenants from one account?

    Yes. Add each client tenant from the Tenants page using an account with Security Reader in that tenant, then switch between them freely. Additional tenants beyond your plan allowance start at $10 per tenant per month and drop as low as $4 with volume and annual billing. See the Managing tenants page for details.